https://seclists.org/oss-sec/2026/q3/945: CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation
Published Sep 25, 2026
·Updated
Affected Software
1 affected component
Apache Roller=6.1.5
Frequently Asked Questions
1
Which deployments and users are exposed?
Apache Roller 6.1.5 is affected in its default configuration; no optional feature or non-default setting is required. Any logged-in author or administrator can be targeted if induced to visit a crafted page.
2
What does an attacker need to exploit this issue?
An attacker can operate remotely and does not need authentication, but must cause a logged-in Roller user to interact with a crafted page. Successful exploitation causes state-changing actions to run with that victim's authority.
3
What is the recommended remediation?
Upgrade Apache Roller to version 6.1.6 or later. The fix validates only the salt submitted by the client and applies the same validation to multipart forms.